feat(doctor): permissioned fix mode — §6.12 compliance

- --fix 先显示所有 fix 方案，再 readline 询问用户确认
- 拒绝直接执行，需用户输入 y 才继续
- DoctorService.fix() 支持 toolchain.* 工具通过 apt 安装
- 支持 display (ImageMagick) 安装
- fix 后自动重跑 diagnostics 显示更新状态
- 输出按 category 分组显示

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/runtime/src/doctor/DoctorService.ts

@@ -112,7 +112,27 @@ export class DoctorService {
       case 'project_structure': {
         return { ok: false, message: 'Run air init to create project structure' }
       }
+      case 'display': {
+        try {
+          execFileSync('sudo', ['apt', 'install', '-y', 'imagemagick'], { stdio: 'pipe', timeout: 60000 })
+          return { ok: true, message: 'ImageMagick installed' }
+        } catch (e: any) {
+          return { ok: false, message: `ImageMagick install failed: ${e.message}` }
+        }
+      }
       default:
+        // Toolchain fix: try apt install
+        if (check_name.startsWith('toolchain.')) {
+          const pkg = check_name.replace('toolchain.', '')
+          const pkgMap: Record<string, string> = { cmake: 'cmake', ninja: 'ninja-build', cppcheck: 'cppcheck', clangd: 'clangd', 'g++': 'g++' }
+          const aptPkg = pkgMap[pkg] || pkg
+          try {
+            execFileSync('sudo', ['apt', 'install', '-y', aptPkg], { stdio: 'pipe', timeout: 120000 })
+            return { ok: true, message: `${pkg} installed via apt` }
+          } catch (e: any) {
+            return { ok: false, message: `Failed to install ${pkg}: ${e.message}` }
+          }
+        }
         return { ok: false, message: `Fix for ${check_name} not implemented` }
     }
   }